Federal Chief Information Security Officers: Opportunities Exist to Improve Roles and Address Challenges to Authority
Abstract
Federal agencies face an ever-increasing array of cyber threats to their information systems and information. To address these threats, FISMA 2014 requires agencies to designate a CISOa key position in agency efforts to manage information security risks. GAO was asked to review current CISO authorities. This report identifies (1) the key responsibilities of federal CISOs established by federal law and guidance and the extent to which federal agencies have defined the role of the CISO in accordance with law and guidance and (2) key challenges of federal CISOs in fulfilling their responsibilities. GAO reviewed agency security policies, administered a survey to 24 CISOs, interviewed current CISOs, and spoke with officials from OMB. GAO is making 33 recommendations to 13 agencies to fully define the role of their CISOs in accordance with FISMA 2014. Twelve of the 13 agencies concurred with the recommendations addressed to them. One agency partially concurred or did not concur with the recommendations directed to it. GAO continues to believe that these recommendations are valid and should be implemented as discussed in this report. GAO also recommends that OMB issue guidance for clarifying CISOs roles in light of identified challenges. OMB partially concurred with the recommendation. GAO maintains that action is needed as discussed further in the report.
Document Details
- Document Type
- Technical Report
- Publication Date
- Aug 26, 2016
- Accession Number
- AD1169887
Entities
People
- Adam Vodraska
- Alan Macmullin
- Brian Vasquez
- David Plocher
- Edward Varty
- Gregory C. Wilshusen
- Kelly Rubin
- Lee Mccracken
- Nick Marinos
- Paris Hawkins
- Quintin Dorsey
- Wayne Emilien
- Wil Holloway
- William Cook
Organizations
- United States Government Accountability Office